From what I understood re. !2n, it was not really faked, but an error caused (supposedly) by Q himself:
If you check the IDs of these two posts:
>qarchives.ml/images/8pol/11068694.PNG
>http://qarchives.ml/images/8pol/11068701.PNG
then you'll see they're identical. However, since it likely was an error in entering the pass,
>qarchives.ml/images/8cbts/139792.PNG
!2n is not/has never been a confirmed, valid tripCode of Q.